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In this letter we present the first implementation of a quantum coin tossing protocol. This protocol 
belongs to a class of "two-party" cryptographic problems, where the communication partners distrust 
each other. As with a number of such two-party protocols, the best implementation of the quantum 
coin tossing requires qutrits. In this way, we have also performed the first complete quantum 
communication protocol with qutrits. In our experiment the two partners succeeded to remotely 
toss a row of coins using photons entangled in the orbital angular momentum. We also show the 
experimental bounds of a possible cheater and the ways of detecting him. 

PACS numbers: 03.67.Hk, 03.67.Dd, 42.65.Lm 



In the original "coin tossing" protocol, Alice and Bob 
had just divorced and didn't want to ever see each other 
again but they had to decide who kept the dog 0]. As 
they didn't trust any third party as a referee, they agreed 
to toss a coin to decide. How could, let's say, Bob be 
sure, that Alice is honest when she said "It was tails... 
you lost" if he could not see the outcome of the toss?. 
This simple protocol is at the heart of other more com- 
plicated cryptographic problems, like mail certification, 
remote contract signing and mental poker. Also, this pro- 
tocol belongs to a set of cryptographic problems where we 
don't distrust a third party who can eavesdrop our secret, 
but the problem is to control the information that the 
two communication partners share. This set of protocols 
are usually called "post cold war" protocols 2j. Other 
examples of this kind of problems are the "bit commit- 
ment" protocol or the computation of a function where 
the inputs are distributed. 

In the last years this kind of protocols have received a 
lot of attention from both the cryptographic and quan- 
tum information communities. Although the perfect se- 
curity of some of the "two-party" protocols seems im- 
possible 0, 0, , it is yet unclear which bounds can be 
imposed on the security. There have been also some spec- 
ulation about the possibility that quantum mechanics 
can be derived only from purely quantum information 
postulates, stating the possibility and impossibility of, 
respectively, quantum key distribution and quantum bit 
commitment |6j. 

In the case of "coin tossing" , a set of solutions to this 
problem works in the following way: Alice throws the 
coin, locks it in a "box" and sends it to Bob. Bob has 
the proof that the coin was thrown, but cannot see the 
actual result. Bob makes his bet and, upon receiving 
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his bet, Alice sends the key to Bob, so that he is able 
to unlock the result Q- Up to now, there is no proof 
that the "boxes" used in the classical implementations of 
this protocol (for example, one-way functions), are truly 
impossible to unlock by Bob, or cannot be modified by 
Alice (see Fig. 1(a)). In general, there is no classical pro- 
tocol which allows unrestricted security against cheating 
for the "coin tossing" protocols. On the other hand, us- 
ing quantum mechanics, it is possible to at least limit the 
ability of any party to cheat. 

In quantum coin tossing [j| [j| 0, 0, , we replace 
the "box" by a quantum state. Alice chooses one among 
a series of non-orthogonal states and sends it to Bob. 
Each of the states encodes the result of the throw of the 
coin. In this way, without previous knowledge, Bob can- 
not know with certainty which of the states he possesses. 
At this point, Bob makes his bet. To "unlock" the state, 
Alice only has to tell Bob which was the state she sent 
and then he can measure it in an orthogonal basis to 
check that Alice is honest. If Bob's measurement cor- 
responds with Alice's predicted state, the protocol is a 
success. Otherwise, Alice and Bob would consider the 
throw as a "failure" and would disregard it. This coin 
tossing scheme limits the probability of a cheater to suc- 
ceed. We will show that, in reality, cheating is actually 
detected when the "failures" in a row of throws increase 
over the statistical errors. 

Our implemented protocol is based on a proposal 
by Ambainis Q which uses three-dimensional quantum 
states (also called "qutrits"). Up to now, all the devised 
protocols using qubits allow a theoretical higher proba- 
bility for the cheater to win In this sense the pro- 
tocols using qutrits are better suited for this particular 
problem. This raises an interesting question about which 
other problems can also be more efficiently solved with 
higher dimensional states [lij ]. 

The series of states that Alice can send and the corre- 
spondent throw of the coin are presented in Table 1 . 
Alice's states are divided into two sets, each of them con- 
taining two orthogonal states. States of one set have a 
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TABLE I: Here we show the four different states sent by Alice 
and the bases used by Bob to properly characterize the incom- 
ing photon. The Alice's states are divided into two sets of two 
states. Each set represents a particular side of the coin. Bob 
uses two basis, corresponding to Alice's states, each expanded 
by one further orthogonal state. The label of the states eases 
their recognition in Fig. 1 

non- vanishing projection onto states of the other set. For 
this reason, Bob needs two different measuring bases in 
order to determine the state of each possible photon sent 
by Alice. In Table 1, we also show the elements of Bob's 
bases associated with each set. Note that every basis 
contains, besides the states of the corresponding set, a 
third state orthogonal to them, which in our case is ei- 
ther |2) (set 1) or |1) (set 2). These additional states are 
crucial for increasing the chances to detect cheating, as 
we will show below. Ambainis || demonstrated that the 
maximum probability that one of the partners biases the 
result without being noticed is 25%. Remember that, in 
any coin tossing, each party needs to cheat only in 50% 
of the throws, because that's the probability of losing, 
which limits the theoretical probability of a cheater to 
win to 75%. 

In our experiment Alice and Bob agreed to build the 
following set-up to implement the protocol (See Fig. 
1(b)). Alice possess a source of orbital angular momen- 
tum entangled photons [lil fl7j | . She keeps one photon 
of the pair and sends the other one to Bob. When she 
projects her photon onto one of the four states in Tab. 
1 and detects it, she knows that she is sending to Bob a 
triggered photon [lij carrying an orbital angular momen- 
tum qutrit. Together with the photon, she sends a signal 
to Bob, telling him that a coin has been thrown and so, 
the corresponding entangled photon with the right state 
is being sent to him. Once Bob receives the signal, he 
sends his bet to Alice. Now she can tell Bob which was 
the state. Using this information, Bob can measure the 
state of the photon and verify the honesty of Alice. 

The set-up consists of a 351nm wavelength Argon-ion 
laser pumping a 1.5— mm-thick BBO (/3-barium-borate) 



crystal cut for Type I phase matching condition. The 
crystal is positioned such as to produce down-converted 
pairs of identically polarized photons at a wavelength of 
702nm emitted at an angle of 4° off the pump direction. 
These photons are directly entangled in the orbital an- 
gular momentum degree of freedom. One of the photons 
is sent to Bob, meanwhile the other remains on Alice's 
side. With a series of beam-splitters, whose reflectances 
were chosen so that the photons were equally distributed 
among the different paths, both parties direct their pho- 
tons probabilistically to a series of holograms and single 
mode fibe rs, p repared to project the photon onto a cer- 
tain state |l9j. Alice's and Bob's states are presented in 
Table 1. 

Bob's measurements were performed in the following 
way: Bob's photons were directed randomly to a pro- 
jection onto one of the six possible states. The photons 
going to the wrong basis were discarded. 

Once the set-up was built, Alice and Bob decided to try 
their coin-tossing protocol with a row of throws. In this 
experiment they obtained 50% heads (1) and 44% tails 
(0). As Bob's guesses were random, he won in half of the 
throws. The overall failures in the protocol represented 
around 6% of the throws, intrinsic to the setup. In Fig. 2 
(a)-(b) we present the experimental probabilities of Bob's 
measurements, for two different states sent by Alice. 

In Fig. 3(a), we show a set of the actual throws. Every 
square of the image represents a throw of the coin. The 
color of every square represents the result of the throw, 
as Alice communicates it to Bob (black is tails, white is 
heads). Red (gray) means that the throw was a failure. 

In order to explore the limits of the implementation 
Alice decided to cheat Bob. We want to remark that it 
is a harder problem to devise a cheating procedure, than 
to prepare the honest protocol. In our case, the best 
way we could find for Alice to cheat was the following 
one. Alice always sends a random symmetric mixture 
of the state (|0) - |l))/\/2 and the state (|0) + |2))/\/2, 
which is a random mixture of being heads or tails [2fJ. 
When Bob makes his bet about the state, Alice always 
tells him that he lost, and then, Bob has to measure in 
the corresponding basis. For example, if Bob says that 
it was tails, Alice's answer is that the state was heads 
((|0) — \1))/V2), and Bob measures in this basis. It is 
an easy task to check that Alice will win in 63.5% of the 
throws, which is below the theoretical maximum of 75% 
H, 0| . This strategy resembles a biased coin which can 
be flipped even after Bob made his choice. 

In order to force Alice to cheat, we changed states A12 
and A21 to be identical to states number A22 and All, 
respectively. Alice does not need to keep a record of 
which state is being sent. In this way she sends a prob- 
abilistic mixture of the two states, which represent cor- 
respondingly heads and tails. Her strategy is to tell Bob 
that the state sent was exactly the opposite of Bob's bet. 

In the experimental implementation, of course, it is 
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even harder for Alice to win, because she cannot turn off 
the statistical errors which also happen in the honest pro- 
tocol. In our case, we found that the number of failures, 
when Alice cheats in this way, was a 46% of the throws. 
In Fig. 2 (c)-(d), one can check Bob's results for the two 
different states that Alice claimed she was sending. Also, 
we present the actual row of throws in Fig. 3(b), with 
the same coding colors than Fig. 3(a). In this case, by 
comparing the results presented in images (a) and (b) it 
was very easy for Bob to discover that in (b) the protocol 
was not followed in the honest way. Also, it was a little 
bit suspicious to him that in all the proper throws of Fig. 
3(b), Alice won. 

At this point, let us turn back to Fig. 2(c)-(d). We 
want to note that the state in which most of the failures 
go is precisely the one which is outside the plane defined 
by the elements of Alice's set. It is unclear whether other 
cheating procedures would give rise to the same result 
but, at least in this case, the use of a three dimensional 
space is necessary in order that Bob can detect Alice 
cheating. 

Once the subject was clarified between Alice and Bob, 
he decided to build a table where he could infer the 
amount of dishonest throws, given the number of failures 
during the protocol (Fig. 3(c)). 

Before finishing, we would like to discuss a few details 
from this particular implementation. In a proper proto- 
col, the detection of the photon by Bob should be delayed 
until he can send his bet to Alice. In our set-up, it was 
very difficult to prepare such a delay and so, we simulated 
it by software. A more realistic implementation should 
include an optical delay with, for example, a couple of 
parallel mirrors. 

Another difference with respect to an ideal implemen- 
tation is that both Alice and Bob could not determinis- 
tically project their photon onto a given state. Although 
it is clear that this is not a problem for an honest Alice, 
who chooses at random which state to send among the 
possible four, it might present a security hazard when 
one of the parties cannot be trusted. A closer look to the 
set-up shows that this is not the case. 

If Bob's photon goes to the wrong projection, Bob just 
loses the photon and has to ask Alice to send it again. 
Alice cannot take profit of this effect, because she never 
knows whether the photon she sends is going to the right 
projection or not. 

On the other hand, Bob could try to use this proba- 
bilistic behavior in his favor, just by not acknowledging 
a right measurement of a lost bet. But then Alice would 
notice an abnormal increase of lost photons and would 
stop the communication, in the same way as an increase 
of "failures" would be the trademark of a cheater. 

In conclusion, we have experimentally demonstrated a 
"quantum coin tossing" protocol. To our knowledge, this 
is the first "two-party" communication protocol which is 
solved using the laws of quantum physics to encode the 



communication. It is worth mentioning that, contrary to 
the usual "key distribution" protocols, in this case the 
information shared by Alice and Bob is truly exchanged 
through the quantum states. Also, this protocol is the 
first to be implemented, where the use of more than two 
dimensions presents a clear advantage. Using our set-up 
we could share a set of a few tens of thousand coin throws 
in a few seconds among two parties. We also allowed one 
party to try to cheat, which could be easily detected by 
a significant increase of "failures". We could not find 
an optimal cheating procedure, but we hope that this 
work triggers others, where the possibilities of realistic 
dishonest parties are studied. 
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FIG. 1: a) Sketch of the implemented "coin tossing" protocol: 
First step, Alice throws a coin, encodes it in a quantum state 
and sends it to Bob. Second step, Bob's sends his bet to 
Alice. Third step, Alice tells Bob which state it was and Bob 
unlocks the result by measuring the state, b) Diagram of the 
set-up used. Alice possesses a source of entangled photons. 
Using beamsplitters, she projects probabilistically one of the 
photons onto one of the four possible states shown in Table 1. 
This state is transferred nonlocally to the other photon, which 
is on its way to Bob. Bob's photon is projected randomly onto 
one of the six possible elements of the two bases. Photons 
going to a wrong basis are not considered. 



FIG. 3: (a)-(b) Two different ordered rows of throws. Upper 
left corner: first throw, lower right corner: last throw. Color 
code as in Fig. 2, Black: head, White: tail and Red (gray): 
"Failure", (a) Bob and Alice are honest: Heads 50%, tails 
44%, failures 6%. The difference between heads and tails due 
to different efficiencies of the detectors and the failures due 
to imperfections of the set-up. (b) Bob honest, Alice cheats. 
Heads 26%, tails 28%, failures 46%. One can clearly see how 
the failures increase due to the fact that Alice is cheating, (c) 
Probability of failure as a function of the amount of cheating 
by Alice. Solid line: theory. Circles: Experimental data. 



FIG. 2: Statistics of Bob's measurements. Red (gray) bars 
correspond to "failures" of the protocol. Black (heads) and 
white (tails) bars correspond to proper throws and indicate 
the result of the tossing, (a)-(b) Alice is honest. We present 
only two of the possible four states sent by Alice: (a) she 
sends the state |0) + |l))/\/2 (Heads) and (b) she sends the 
state |0) - |2))/V2 (Tails). The errors in this case are due 
to misalignments of the set-up and are intrinsic to it. (c)-(d) 
Alice is cheating. She always sends a mixture of two states. 
After Bob makes his bet, she decides which state she must 
tell him: (c) she claims to send state |0) — |l))/\/2, (d) she 
claims to send state |0) + |2))/\/2. In this case, the errors are 
clear indicators of the presence of a cheater. The difference 
of the errors of cases (c) and (d) are mainly due to the fact 
that Alice is not sending a perfect mixture of the two states. 
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